The release of the main branch nginx 1.25.3 has been formed, continuing the development of new capabilities. In the concurrently supported stable branch 1.24.x, only changes related to serious bugs and vulnerabilities are made. In the future, a stable branch 1.26 will be formed based on the main branch 1.25.x. The project code is written in C and distributed under the BSD license.
Among the changes:
- Protection against abnormal activity from HTTP/2 clients has been strengthened, particularly against 'Rapid Reset' DoS attacks, which create a large number of instantly reset streams within a single HTTP/2 connection. In the default configuration, such attacks are limited by the 'keepalive_requests' connection request limit (after every 1000 requests, the connection will be reset) and the 'limit_req' constraints. To respond more quickly to request flooding via numerous streams, an additional limit has been introduced, which prevents the creation of more than 256 (2 * max_concurrent_streams) new streams per event processing cycle by default. This new restriction allows requests to be blocked before reaching the overall limit on the number of concurrent streams, for example, when streams are processed asynchronously or reset. A similar change was also included in the release of angie 1.3.1 (a fork of nginx) published a week ago.
- Buffer management used for automatic detection of HTTP/2 connections has been improved.
- Performance of configurations with a large number of 'location' directives has been enhanced.
- The crash of the worker process observed when attempting to use HTTP/2 without SSL.
- The incorrect handling of the 'Status' header returned by the backend with an empty explanatory text has been fixed.
- A memory leak during reconfiguration, occurring when built with the PCRE2 library, has been eliminated.
- A significant number of fixes and improvements related to HTTP/3 protocol support have been introduced.
The release of njs 0.8.2, a JavaScript language interpreter, also took place. web servers nginx. The njs interpreter implements ECMAScript standards and allows nginx to enhance request processing capabilities using scripts in the configuration. Scripts can be used in the configuration file to define extended request processing logic, form configurations, dynamically generate responses, modify requests/responses, or quickly create placeholders to address issues in web applications. The new version includes the console object, which provides the methods error(), info(), log(), time(), timeEnd(), and warn(). The fs module has added the fs.existsSync() method.
Also noteworthy is the release of the NGINX Unit 1.31.1 application server, providing a solution for running web applications in various programming languages (Python, PHP, Perl, Ruby, Go, JavaScript/Node.js, and Java). Under NGINX Unit, multiple applications in different programming languages can run simultaneously, with launch parameters that can be changed dynamically without modifying configuration files and restarting. Besides bug fixes, the new version allows loading data larger than 4 GB in the Wasm module, and it’s now possible to set HTTP status codes in responses.
Source: opennet.ru
